jqlang jq jv_parse_sized length out-of-bounds

Summaryinfo

A vulnerability categorized as critical has been discovered in jqlang jq. The impacted element is the function jv_parse_sized. Executing a manipulation of the argument length can lead to out-of-bounds. This vulnerability is tracked as CVE-2026-39979. The attack can be launched remotely. No exploit exists. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability has been found in jqlang jq (affected version unknown) and classified as critical. This vulnerability affects the function jv_parse_sized. The manipulation of the argument length with an unknown input leads to a out-of-bounds vulnerability. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() API in libjq accepts a counted buffer with an explicit length parameter, but its error-handling path formats the input buffer using %s in jv_string_fmt(), which reads until a NUL terminator is found rather than respecting the caller-supplied length. This means that when malformed JSON is passed in a non-NUL-terminated buffer, the error construction logic performs an out-of-bounds read past the end of the buffer. The vulnerability is reachable by any libjq consumer calling jv_parse_sized() with untrusted input, and depending on memory layout, can result in memory disclosure or process termination. The issue has been patched in commit 2f09060afab23fe9390cce7cb860b10416e1bf5f.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-39979 since 04/08/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 307502 (Azure Linux 3.0 Security Update: CBL-Mariner Releases (CVE-2026-39979)), which helps to determine the existence of the flaw in a target environment.

Applying the patch 2f09060afab23fe9390cce7cb860b10416e1bf5f is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the databases at Tenable (307502) and CERT Bund (WID-SEC-2026-1183). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux
• RESF Rocky Linux

Productinfo

Vendor

• jqlang

Name

• jq

License

• open-source

Website

• Product: https://github.com/jqlang/jq/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion